Using Microsoft Azure Entra ID Multifactor Authentication for CTE GuardPoints

Create an OIDC Application in Entra ID

1. Select Microsoft Entra ID from your Azure Homepage.

2. Click App Registration.

3. Create a New Registration.

4. Record the client ID. You will need it when you create an OIDC connection on CipherTrust Manager.

5. Click Certificates and Secrets in the left Nav bar.

6. Create a new Client Secret. This is the Client Secret value that you will enter in CipherTrust Manager.

7. For the Redirect URI, select Web.

8. Enter redirect URL with your local host name: http://<localhost>:5560/auth/callback and save it.

9. Click on the name of your registration and click Endpoints.

10. Copy the value for the Endpoint for OpenID Connect metadata document. This is the OIDC Provider value that you will enter in CipherTrust Manager.

Create an OIDC Connection in CipherTrust Manager

1. Log on to the CipherTrust Manager as an administrator.

2. In the left pane, click Access Management > Connections.

3. In the Connections, click Add Connection.

4. Click OIDC and then click Next.

5. Provide a name for the connection and click Next.

6. Enter values collected in the previous section for the configuration information.

   • OIDC Provider: <value for the Endpoint for OpenID Connect metadata document>

   • Client ID

   • Client Secret

7. Click Next and in the Add Products window, select CTE for product.

8. Click Add Connection.

Set Client Profile in CipherTrust Manager

1. In CipherTrust Manager, open the Transparent Encryption application.

2. In the left pane, click Settings > Profiles.

3. Select the desired client profile.

4. Expand MULTIFACTOR AUTHENTICATION.

5. Select the OIDC Connection that you created for Entra ID.

6. Select MFA Exempted User Set from the drop-down list. This user set will be exempted from MFA so MFA will not be enforced on the users of this set. See Exempting some users from authentication with a Whitelist for more information.

Domain Mapping

Domain mapping is required for Entra ID. If you try to log in prior to mapping the domain, CTE generates an error.

You must map the domain from the Entra ID domain to the domain of the existing CTE host. Ask your System Administrator for the domain information.

1. To set the domain, type:

   voradmin mfa domains-map set <domain1>:<domain2>
   

   Example

   voradmin mfa domains-map set thalesgroup.com:qa.com
   

   Response

   Restart secfsd service to affect changes.
   

   Note

   You can map multiple domains using a comma in between domain names. For example:

   voradmin mfa domains-map set <domain-1-onMFA-provider>:<domain-1-onHost>,<domain-2-onMFA-provider>:<domain-2-onHost>

2. To stop secfsd, type:

   net stop secfsd
   

3. To restart secfsd, type:

   net start secfsd